Errors in Kibana with Metricbeat 6.7.1+

[alexz00]

Running Kibana (I tried different versions, from 6.5.x to 7.1.1) with Metricbeat 6.7.1 and 7.1.1 I see several errors in Kibana:

• Unable to see metricbeat-* index pattern in Kibana: Request Timeout error
• Unable to open the Discover panel in Kibana: Request Timeout error
• Some system dashboard panels fail to load for timeout

See here for further details: Kibana fails to create metricbeat index pattern

Finally I tried Metricbeat 6.7.0, and everything started to work as expected (both with ES/Kibana 6.5.3 and 6.7.1).
My guess is that there is something in the Elasticsearch templates starting from v. 6.7.1 that prevents Kibana to correctly generate/manage the index pattern.

[Mario_Castro]

Hi @alexz00

Can you describe the process to reproduce the issue? I'm not sure reading both posts you wrote. It seems there's a specific version mismatch that potentially is not working. You detailed the versions that worked but not specifically the ones you had originally that didn't work. You mention Elastic 6.7.1 referring to Elasticsearch 6.7.1 and Metricbeat 6.7.1?

Thanks

[alexz00]

Yes, sorry, my message was not so clear. But yes, it worked with ES/Kibana 6.5.3 and Metricbeat 6.7.1.

Anyway today I run some further tests and I opened Kibana from another PC (i.e. from a different Chrome instance) and also with all components on 6.7.1 it seems to work.
I also tried from MS Edge and it seems ok.

At this point I think it was some issue between Chrome and Kibana, resulting in a Timeout Request exception. I'd close this thread (and the other one) and wait to see if the same issue happens again.

Thanks

[garaboncias]

As i add dashboards to kibana with "sudo metricbeat setup --dasboards" (Metricbeat 7.2 on debian) its appears but most of them broken. Example: Metricbeat-system-overview

as I see field is empty in the query
when I check it in, query is missing and also no "savedSearchId":
/usr/share/metricbeat/kibana/7/dashboard/Metricbeat-system-overview.json

{
"attributes": {
"description": "",.
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"filter": , "index": "metricbeat-*", "query": {"query": "", "language":
},.
"title": "Number of hosts [Metricbeat System] ECS",.
"uiStateJSON": "{"vis": {"defaultColors": {"0 - 100": "rgb(0,104,55)"}}}",.
"version": 1,.
"visState": "{"type": "metric", "params": {"gauge": {"useRange": false, "gaugeType": "Metric", "sty
},.
"id": "c6f2ffd0-4d17-11e7-a196-69b9a7a020a9-ecs",.
"type": "visualization",.
"version": 2
}

[Kaiyan_Sheng]

Hello, what version of Kibana are you running? Also do you have metricbeat running with system enabled when you saw this error?

[garaboncias]

Hi Kaiyan,
I just installed the 7.2 stack

[garaboncias]

As I got some experience it seams that fields which has ".keywords" endings seams the one of source of the issue.

[garaboncias]

I found a similar issue:

Issue: Example visualizations not working, grouping by .name instead of .name.keyword

in my case I have to modify all host.name to host.name.keyword

[Kaiyan_Sheng]

Hmm ok that sounds like a problem with the index pattern. Can you stop metricbeat, remove the index pattern of metricbeat from kibana management? And then remove the metricbeat index and template as well using command:

GET _cat/indices

DELETE metricbeat-7.2.0-2019.07.12-000001

GET _cat/templates

DELETE _template/metricbeat-7.2.0

Then restart Metricbeat with system module enabled.